Protection of personal data: adequacy of the US safe harbor privacy principles

This Commission staff working paper concerns the application of Commission decision 520/2000/EC of 26 July pursuant to Directive 95/46 of the European Parliament and of the Council on the adequate protection of personal data provided by the Safe Harbour Privacy Principles and related Frequently Asked Questions issued by the US Department of Commerce. On the basis of all the information collected, the Commission's services note that: - all the elements of the Safe Harbour arrangement are in place. The framework is providing a simplifying effect for those exporting personal data to the 129 US organisations in the Safe Harbour as of 1 December 2001 and reduced uncertainty for US organisations interested in importing data from the EU by identifying a standard that corresponds to the adequate protection required by the Directive; - individuals are able to lodge complaints if they believe their rights are being denied, but few have done so and to the Commission's knowledge, no complaint so far remains unresolved; - a substantial number of organisations that have self-certified adherence to the Safe Harbour do not seem to be observing the expected degree of transparency as regards their overall commitment or as regards the contents of their privacy policies. Transparency is a vital feature in self-regulatory systems and it is necessary that organisations improve their practices in this regard; - a wide array of sanctions to enforce Safe Harbour rules exist under dispute resolution mechanisms. But not all dispute resolution mechanisms have indicated publicly their intention to enforce Safe Harbour rules and not all have in place privacy practices applicable to themselves that are in conformity with the Principles, as required by Safe Harbour rules. Enforcement is a key element in the Safe Harbour framework and it is therefore necessary that Safe Harbour organisations use only dispute resolution mechanisms that fully conform to Safe Harbour requirements. The Commission's recent Decisions approving standard contractual clauses for the transfer of data to third countries in no way affect the validity of the Safe Harbour arrangement, which should remain an attractive option for eligible organisations regularly involved in data transfers. The Commission services will continue to co-operate with the Department of Commerce in encouraging US organisations to join and to insist on a rigorous respect for the transparency requirement of the Safe Harbour. The Commission's services and the US Department of Commerce have agreed that transparency is a vital feature in self-regulatory systems and they look to the organisations concerned to improve their practices in this regard. They consider that some at least of the shortcomings identified can be put down to "teething problems". The Commission's services welcome the readiness of the US Department of Commerce to address some of them through improvements in the self-certification process. They consider that it is through the vigilance and enforcement action of the relevant public authorities in the US that the arrangement will remain credible and serve its purpose as a guarantee of adequate protection for personal data transferred from EU to the US. Other stakeholders including consumers and business may find this working document useful in order to make their own assessment ofthe application of the "Safe Harbor" arrangement. These assessment would be a useful contribution to the Commission's evaluation of the Safe Harbor arrangement planned for 2003.�